U.S. Cyber Command warns of North Korea

It's the second time in as many months Cyber Command has added malware details to VirusTotal.

Malicious software samples uploaded by U.S. Cyber Command to VirusTotal on Wednesday are associated with campaigns from Lazarus Group, an advanced persistent threat group linked with North Korea, two cybersecurity researchers told CyberScoop.

Lazarus is an umbrella name that typically describes hacking activity which advances Pyongyang’s interests. The group is especially known for its financial motivations, such as abusing the Society for Worldwide Interbank Financial Telecommunication (SWIFT) monetary transfer system and for hacking banks, according to Adam Meyers, vice president of intelligence at CrowdStrike. The instance Wednesday marks the second time in as many months Cyber Command added malware details to the VirusTotal security repository as part of an information sharing effort with the private sector.

Researchers from cybersecurity firms Symantec and CrowdStrike said they have linked the two malware samples in this case (available here and here) with Lazarus Group. The technical capabilities of the malware strains were not immediately clear.

Cyber Command uploaded two samples in all, one of which is a DLL, a dynamically linked library, which is usually part of a set of malware. The other file shared is an executable, which is capable of running by itself.

Kaspersky Principal Senior Security Researcher Brian Bartholomew tells CyberScoop the executable file appears to be the same malware that the FBI and the Department of Homeland Security warned industry about in May, known as ELECTRICFISH.

“When reviewing these samples, one appears to be a popular North Korean tunneling tool referred to as ELECTRICFISH and the other is confirmed to be a Fake TLS proxy tool,” Bartholomew said. “This tool allows an attacker to use the victim as a hop point to tunnel traffic through, similar to what ELECTRICFISH does, just in a different way.”

FireEye Director of Intelligence Analysis John Hultquist told CyberScoop the samples are possibly linked to APT38, a North Korean group FireEye detailed last year which they showed was zeroed in on stealing money and which uses destructive malware.

The Lazarus-linked samples appear to have originated in 2018 and that they do not appear to be in ongoing attacks right now, Bartholomew says.

The last samples Cyber Command shared last month were linked with Iran, as CyberScoop previously reported.

Lazarus Group often uses password-protected executables and secure deletion functions to conceal its nefarious activity from victims, according to Meyers, of CrowdStrike.

Cyber Command would not comment on attribution, as has been its standard practice with VirusTotal releases.

“The Cyber National Mission Force is releasing malware as part of the U.S. Cyber Command persistent engagement methodology,” a spokesperson told CyberScoop. “Recognizing the value of collaboration with the cybersecurity industry and public sector, the [Cyber National Mission Force] is continuing to share malware samples it believes will have the greatest impact on improving global security.”

This update also comes as the federal government’s wider information sharing program is maturing. In the last VirusTotal release, Cyber Command gave advance warning of the release to the Department of Homeland Security, which also included the private sector, as CyberScoop first reported.

The early alert went out to private sector in advance of the release this time as well, Neil Jenkins of the Cyber Threat Alliance tells CyberScoop. Members of the alliance, a group of companies that shares threat information, were alerted Monday with a TLP Amber alert, meant to signify information cannot be shared publicly and only among concerned parties, Jenkins said.

As a result, Cyber Threat Alliance members, which include the likes of Symantec, McAfee, Palo Alto Networks, and Cisco, were able to protect against the malware samples before Cyber Command flagged them publicly, according to Jenkins.

“Our members were able to get protections ready and in place for the release yesterday,” Jenkins told CyberScoop.

The Department of Homeland Security did not immediately return request for comment.

Some of Lazarus Group’s activity has stemmed from sanctions slapped on North Korea, which have starved Kim Jong-un’s government of financial resources, Meyers notes. The Lazarus Group targeted SWIFT after sanctions banned North Korea from that international financial network in 2017, for instance.

A leaked United Nations report recently sent to the U.N. Security Council’s North Korea sanctions committee says Pyongyang has used 35 cyberattacks to steal $2 billion to fund its weapons programs. The regime “used cyber-space to launch increasingly sophisticated attacks to steal funds from financial institutions and cryptocurrency exchanges to generate income,” the report’s authors wrote, according to the BBC.

This Cyber Command release comes just days after North Korea claims it launched a new kind of short-range ballistic missile in violation of United Nations resolutions. It’s the third instance of the regime claiming to have tested a new ballistic missile or rocket system in the last month, according to the New York Times.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure